GHSA-hxgx-584x-vwm8

Source

https://github.com/advisories/GHSA-hxgx-584x-vwm8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-hxgx-584x-vwm8/GHSA-hxgx-584x-vwm8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hxgx-584x-vwm8

Aliases

CVE-2023-27159

Published

2023-03-31T21:30:40Z

Modified

2023-11-08T04:12:03.503209Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Appwrite Server-Side Request Forgery vulnerability

Details

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

Database specific

{
    "nvd_published_at": "2023-03-31T19:15:00Z",
    "github_reviewed_at": "2023-04-10T16:42:16Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Packagist / appwrite/server-ce

Package

Name: appwrite/server-ce
Purl: pkg:composer/appwrite/server-ce

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.2.1

Affected versions

0.*

0.1.13

0.1.15

0.2.0

0.3.0

0.4.0

0.5.0

0.5.1

0.5.2

0.5.3

0.6.0

0.6.1

0.6.2

0.7.0

0.7.1

0.7.2

0.8.0

0.9

0.9.1

0.9.2

0.9.3

0.9.4

0.10.0

0.10.1

0.10.2

0.10.3

0.10.4

0.11.0

0.11.1

0.11.2

0.12.0

0.12.1

0.12.2

0.12.3

0.12.4

0.13.0

0.13.1

0.13.2

0.13.3

0.13.4

0.14.0

0.14.1

0.14.2

0.15.0

0.15.1

0.15.2

0.15.3

1.*

1.0.0-RC1

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.2.0

1.2.1